agentworkshop 0.7.66 → 0.7.70

package/package.json

@@ -1,181 +1,185 @@
-{
-  "name": "agentworkshop",
-  "version": "0.7.66",
-  "type": "module",
-  "description": "AgentWorkShop 软件开发系统 - 基于 Nuxt 4 的配置驱动运行范式",
-  "license": "Apache-2.0",
-  "exports": {
-    ".": {
-      "types": "./sdk/index.d.mts",
-      "default": "./sdk/index.mjs"
-    },
-    "./sdk": {
-      "types": "./sdk/index.d.mts",
-      "default": "./sdk/index.mjs"
-    },
-    "./sdk/client": {
-      "types": "./sdk/client.d.mts",
-      "default": "./sdk/client.mjs"
-    },
-    "./package.json": "./package.json"
-  },
-  "bin": {
-    "aw": "bin/aw.mjs",
-    "agentworkshop": "bin/aw.mjs"
-  },
-  "files": [
-    ".output",
-    "bin",
-    "cli",
-    "sdk",
-    "app",
-    "server",
-    "shared",
-    "i18n",
-    "public",
-    "scripts",
-    ".AgentWorkShop/prompts",
-    "server/plugins-builtin",
-    "mcp",
-    "config.yml",
-    "nuxt.config.ts",
-    "tsconfig.json",
-    "uno.config.ts",
-    "docker-compose.yml",
-    ".env.example",
-    "README-zh.md",
-    "docs/cli.md",
-    "docs/cli.en.md",
-    "docs/plugins.md",
-    "docs/plugins.en.md",
-    "docs/sdk.md",
-    "docs/sdk.en.md",
-    "docs/aml.md",
-    "docs/mcp.md",
-    "docs/mcp.en.md",
-    "docs/tui.md",
-    "docs/full-test-plan.md",
-    "docs/multi-harness-architecture.md",
-    "tui"
-  ],
-  "packageManager": "pnpm@11.9.0",
-  "engines": {
-    "node": ">=23.4.0"
-  },
-  "scripts": {
-    "dev": "node bin/aw.mjs dev",
-    "build": "node bin/aw.mjs build",
-    "start": "node bin/aw.mjs start",
-    "generate": "nuxt generate",
-    "preview": "node bin/aw.mjs start",
-    "cli": "node bin/aw.mjs",
-    "tui": "node tui/aw-tui.mjs",
-    "postinstall": "node scripts/home-bootstrap.mjs",
-    "prepublishOnly": "node bin/aw.mjs build",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "typecheck": "node scripts/typecheck.mjs",
-    "docs:check": "node scripts/check-docs-sync.mjs",
-    "docs:dev": "cd docs/site && npx vitepress dev",
-    "docs:build": "cd docs/site && npx vitepress build",
-    "test:plugin-lifecycle": "node scripts/test-plugin-lifecycle.mjs",
-    "test:sdk-surface": "node scripts/test-sdk-surface.mjs",
-    "test:twin-provider": "tsx --test tests/aml-twin-provider-registry.test.ts",
-    "test:unit": "tsx --tsconfig .nuxt/tsconfig.server.json --test --test-force-exit tests/*.test.ts",
-    "prepare": "husky",
-    "test:api-live": "node scripts/api-live-e2e.mjs",
-    "test:mcp": "tsx --tsconfig .nuxt/tsconfig.server.json --test --test-force-exit tests/aw-mcp-server.test.ts",
-    "test:skills": "node scripts/test-aw-skills.mjs",
-    "test:mcp-live": "node scripts/_audit/aw-mcp-live-e2e.mjs",
-    "test:skills-guided": "node scripts/_audit/skills-guided-e2e.mjs",
-    "ui:seed": "node scripts/ui/seed-demo.mjs",
-    "ui:shots": "node scripts/ui/shots.mjs",
-    "ui:audit": "node scripts/ui/audit-layout.mjs",
-    "ui:verify": "node scripts/ui/verify-responsive.mjs",
-    "ui:verify-nav": "node scripts/ui/verify-nav.mjs",
-    "readme:lint": "node scripts/ui/md-lint.mjs README.md README-zh.md",
-    "readme:assets": "node scripts/ui/readme-assets.mjs",
-    "game:verify": "node scripts/verify-game.mjs",
-    "game:build-assets": "node scripts/build-player-sheet.mjs",
-    "game:build-wuwa": "node scripts/build-wuwa-assets.mjs",
-    "game:build-models": "node scripts/build-character-models.mjs",
-    "game:build-world": "node scripts/build-world-map.mjs",
-    "game:build-model3d": "node scripts/build-model-3d.mjs"
-  },
-  "lint-staged": {
-    "*.{js,mjs,cjs,ts,vue}": "eslint --fix"
-  },
-  "dependencies": {
-    "@ant-design-vue/nuxt": "^1.4.6",
-    "@ant-design/icons-vue": "^7.0.1",
-    "@anthropic-ai/claude-agent-sdk": "0.3.266",
-    "@earendil-works/pi-tui": "^0.84.4",
-    "@fontsource-variable/fraunces": "^5.3.0",
-    "@fontsource-variable/geist": "^5.3.0",
-    "@fontsource-variable/geist-mono": "^5.3.0",
-    "@fontsource-variable/inter": "^5.3.0",
-    "@fontsource/eb-garamond": "^5.3.0",
-    "@fontsource/ibm-plex-mono": "^5.3.0",
-    "@iconify-json/tabler": "^1.2.0",
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@nuxtjs/i18n": "^9.0.0",
-    "@pinia/nuxt": "^0.11.0",
-    "@unocss/nuxt": "^66.0.0",
-    "@unocss/preset-attributify": "^66.0.0",
-    "@unocss/preset-icons": "^66.7.5",
-    "@unocss/preset-typography": "^66.0.0",
-    "@vueuse/core": "^13.0.0",
-    "@vueuse/nuxt": "^13.0.0",
-    "@xterm/addon-fit": "^0.11.0",
-    "@xterm/xterm": "^6.0.0",
-    "ant-design-vue": "^4.2.6",
-    "axios": "^1.7.9",
-    "echarts": "^5.6.0",
-    "h3": "2.0.1-rc.26",
-    "js-yaml": "^4.1.0",
-    "minio": "^8.0.7",
-    "modbus-serial": "^8.0.25",
-    "mqtt": "^5.15.2",
-    "node-opcua": "2.178.0",
-    "nuxt": "^4.0.0",
-    "nuxt-auth-utils": "^0.5.0",
-    "pg": "^8.23.0",
-    "phaser": "^4.0.0",
-    "pinia": "^3.0.0",
-    "pinia-plugin-persistedstate": "^4.2.0",
-    "sqlite-vec": "^0.1.9",
-    "three": "^0.185.1",
-    "unocss": "^66.0.0",
-    "unplugin-icons": "^22.0.0",
-    "vue": "^3.5.13",
-    "vue-echarts": "^7.0.3",
-    "vue-router": "^4.5.0",
-    "zod": "^3.24.1"
-  },
-  "optionalDependencies": {
-    "onnxruntime-node": "^1.20.1",
-    "serialport": "^13.0.0"
-  },
-  "devDependencies": {
-    "@commitlint/cli": "^19.6.1",
-    "@commitlint/config-conventional": "^19.6.0",
-    "@nuxt/eslint": "^1.0.0",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^26.2.0",
-    "@types/pg": "^8.23.1",
-    "@types/three": "^0.185.4",
-    "eslint": "^9.17.0",
-    "husky": "^9.1.7",
-    "lint-staged": "^15.3.0",
-    "pngjs": "^7.0.0",
-    "puppeteer-core": "^25.5.0",
-    "tsx": "^4.23.12",
-    "typescript": "^5.7.3",
-    "vue-tsc": "^3.3.10"
-  },
-  "pnpm": {
-    "ignoredBuiltDependencies": [
-      "@serialport/bindings-cpp"
-    ]
-  }
-}
+{
+  "name": "agentworkshop",
+  "version": "0.7.70",
+  "type": "module",
+  "description": "AgentWorkShop 软件开发系统 - 基于 Nuxt 4 的配置驱动运行范式",
+  "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "types": "./sdk/index.d.mts",
+      "default": "./sdk/index.mjs"
+    },
+    "./sdk": {
+      "types": "./sdk/index.d.mts",
+      "default": "./sdk/index.mjs"
+    },
+    "./sdk/client": {
+      "types": "./sdk/client.d.mts",
+      "default": "./sdk/client.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "aw": "bin/aw.mjs",
+    "agentworkshop": "bin/aw.mjs"
+  },
+  "files": [
+    ".output",
+    "bin",
+    "cli",
+    "sdk",
+    "app",
+    "server",
+    "shared",
+    "i18n",
+    "public",
+    "scripts",
+    ".AgentWorkShop/prompts",
+    "server/plugins-builtin",
+    "mcp",
+    "config.yml",
+    "nuxt.config.ts",
+    "tsconfig.json",
+    "uno.config.ts",
+    "docker-compose.yml",
+    ".env.example",
+    "README-zh.md",
+    "docs/cli.md",
+    "docs/cli.en.md",
+    "docs/plugins.md",
+    "docs/plugins.en.md",
+    "docs/sdk.md",
+    "docs/sdk.en.md",
+    "docs/aml.md",
+    "docs/mcp.md",
+    "docs/mcp.en.md",
+    "docs/tui.md",
+    "docs/full-test-plan.md",
+    "docs/multi-harness-architecture.md",
+    "tui"
+  ],
+  "packageManager": "pnpm@11.9.0",
+  "engines": {
+    "node": ">=23.4.0"
+  },
+  "scripts": {
+    "dev": "node bin/aw.mjs dev",
+    "build": "node bin/aw.mjs build",
+    "start": "node bin/aw.mjs start",
+    "generate": "nuxt generate",
+    "preview": "node bin/aw.mjs start",
+    "cli": "node bin/aw.mjs",
+    "tui": "node tui/aw-tui.mjs",
+    "postinstall": "node scripts/home-bootstrap.mjs",
+    "prepublishOnly": "node bin/aw.mjs build",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "typecheck": "node scripts/typecheck.mjs",
+    "docs:check": "node scripts/check-docs-sync.mjs",
+    "docs:dev": "cd docs/site && npx vitepress dev",
+    "docs:build": "cd docs/site && npx vitepress build",
+    "test:plugin-lifecycle": "node scripts/test-plugin-lifecycle.mjs",
+    "test:sdk-surface": "node scripts/test-sdk-surface.mjs",
+    "test:twin-provider": "tsx --test tests/aml-twin-provider-registry.test.ts",
+    "test:unit": "tsx --tsconfig .nuxt/tsconfig.server.json --test --test-force-exit tests/*.test.ts",
+    "prepare": "husky",
+    "test:api-live": "node scripts/api-live-e2e.mjs",
+    "test:e2e-line": "node scripts/e2e-line-governance.mjs",
+    "test:line-log": "node scripts/line-log-smoke.mjs",
+    "test:mes-agent": "node scripts/mes-agent-integration-e2e.mjs",
+    "test:e2e-injection": "node scripts/e2e-injection-recipe-closedloop.mjs",
+    "test:mcp": "tsx --tsconfig .nuxt/tsconfig.server.json --test --test-force-exit tests/aw-mcp-server.test.ts",
+    "test:skills": "node scripts/test-aw-skills.mjs",
+    "test:mcp-live": "node scripts/_audit/aw-mcp-live-e2e.mjs",
+    "test:skills-guided": "node scripts/_audit/skills-guided-e2e.mjs",
+    "ui:seed": "node scripts/ui/seed-demo.mjs",
+    "ui:shots": "node scripts/ui/shots.mjs",
+    "ui:audit": "node scripts/ui/audit-layout.mjs",
+    "ui:verify": "node scripts/ui/verify-responsive.mjs",
+    "ui:verify-nav": "node scripts/ui/verify-nav.mjs",
+    "readme:lint": "node scripts/ui/md-lint.mjs README.md README-zh.md",
+    "readme:assets": "node scripts/ui/readme-assets.mjs",
+    "game:verify": "node scripts/verify-game.mjs",
+    "game:build-assets": "node scripts/build-player-sheet.mjs",
+    "game:build-wuwa": "node scripts/build-wuwa-assets.mjs",
+    "game:build-models": "node scripts/build-character-models.mjs",
+    "game:build-world": "node scripts/build-world-map.mjs",
+    "game:build-model3d": "node scripts/build-model-3d.mjs"
+  },
+  "lint-staged": {
+    "*.{js,mjs,cjs,ts,vue}": "eslint --fix"
+  },
+  "dependencies": {
+    "@ant-design-vue/nuxt": "^1.4.6",
+    "@ant-design/icons-vue": "^7.0.1",
+    "@anthropic-ai/claude-agent-sdk": "0.3.266",
+    "@earendil-works/pi-tui": "^0.84.4",
+    "@fontsource-variable/fraunces": "^5.3.0",
+    "@fontsource-variable/geist": "^5.3.0",
+    "@fontsource-variable/geist-mono": "^5.3.0",
+    "@fontsource-variable/inter": "^5.3.0",
+    "@fontsource/eb-garamond": "^5.3.0",
+    "@fontsource/ibm-plex-mono": "^5.3.0",
+    "@iconify-json/tabler": "^1.2.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@nuxtjs/i18n": "^9.0.0",
+    "@pinia/nuxt": "^0.11.0",
+    "@unocss/nuxt": "^66.0.0",
+    "@unocss/preset-attributify": "^66.0.0",
+    "@unocss/preset-icons": "^66.7.5",
+    "@unocss/preset-typography": "^66.0.0",
+    "@vueuse/core": "^13.0.0",
+    "@vueuse/nuxt": "^13.0.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/xterm": "^6.0.0",
+    "ant-design-vue": "^4.2.6",
+    "axios": "^1.7.9",
+    "echarts": "^5.6.0",
+    "h3": "2.0.1-rc.26",
+    "js-yaml": "^4.1.0",
+    "minio": "^8.0.7",
+    "modbus-serial": "^8.0.25",
+    "mqtt": "^5.15.2",
+    "node-opcua": "2.178.0",
+    "nuxt": "^4.0.0",
+    "nuxt-auth-utils": "^0.5.0",
+    "pg": "^8.23.0",
+    "phaser": "^4.0.0",
+    "pinia": "^3.0.0",
+    "pinia-plugin-persistedstate": "^4.2.0",
+    "sqlite-vec": "^0.1.9",
+    "three": "^0.185.1",
+    "unocss": "^66.0.0",
+    "unplugin-icons": "^22.0.0",
+    "vue": "^3.5.13",
+    "vue-echarts": "^7.0.3",
+    "vue-router": "^4.5.0",
+    "zod": "^3.24.1"
+  },
+  "optionalDependencies": {
+    "onnxruntime-node": "^1.20.1",
+    "serialport": "^13.0.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^19.6.1",
+    "@commitlint/config-conventional": "^19.6.0",
+    "@nuxt/eslint": "^1.0.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^26.2.0",
+    "@types/pg": "^8.23.1",
+    "@types/three": "^0.185.4",
+    "eslint": "^9.17.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.3.0",
+    "pngjs": "^7.0.0",
+    "puppeteer-core": "^25.5.0",
+    "tsx": "^4.23.12",
+    "typescript": "^5.7.3",
+    "vue-tsc": "^3.3.10"
+  },
+  "pnpm": {
+    "ignoredBuiltDependencies": [
+      "@serialport/bindings-cpp"
+    ]
+  }
+}

package/scripts/agent-daq-isolation-e2e.mjs

@@ -0,0 +1,91 @@
+/**
+ * Agent 专属 DAQ 隔离对照：不绑线的 Channel 内，两个 Agent 各绑不同节点，
+ * 验证 daq_query 只返回自己的绑定节点、调用他人节点被拒。
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
+import { join, resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const REPO = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const c = JSON.parse(readFileSync(process.argv[2], 'utf8'))
+const EVID = join(REPO, 'docs', 'audit', '2026-10-21-full-function-evidence')
+mkdirSync(EVID, { recursive: true })
+const results = []
+function ok(id, name, cond, detail = '') {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 600) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${detail ? ` — ${String(detail).slice(0, 220)}` : ''}`)
+}
+async function api(method, path, body, token = c.adminToken) {
+  const r = await fetch(c.base + path, {
+    method,
+    headers: { ...(body !== undefined ? { 'content-type': 'application/json' } : {}), ...(token ? { authorization: `Bearer ${token}` } : {}) },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(60_000),
+  })
+  return { status: r.status, ...(await r.json().catch(() => ({}))) }
+}
+async function invoke(agent, tool, args) {
+  const r = await fetch(c.base + '/api/workshop/agent-tools/invoke', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-aw-agent-token': agent.token },
+    body: JSON.stringify({ agentId: agent.id, tool, args }),
+    signal: AbortSignal.timeout(90_000),
+  })
+  const j = await r.json().catch(() => null)
+  return { isError: Boolean(j?.data?.result?.isError), text: String(j?.data?.result?.text ?? '') }
+}
+
+async function main() {
+  console.log(`━━━ Agent DAQ 隔离对照 @ ${c.base} ━━━`)
+  const daq = Object.values(c.daq ?? {})
+  if (daq.length < 2) throw new Error('需要至少 2 个 DAQ 节点')
+  const aNode = daq[0]
+  const bNode = daq[1]
+  // 注意：刻意不传 lineId —— 无频道绑线扩权，只剩 Agent 直接绑定面
+  const ch = await api('POST', '/api/workshop/channels', {
+    name: `agent-daq-isolation-${Date.now().toString(36).slice(-5)}`,
+    leadAgent: { name: 'iso-lead', harness: 'mock' },
+  })
+  const channelId = ch?.data?.channelId
+  ok('D0', '无绑线隔离 Channel 创建', Boolean(channelId), `lineId=${ch?.data?.lineId ?? '(empty)'}`)
+  if (!channelId) return finish({})
+  const a = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: 'iso-a', harness: 'mock', role: 'worker' })).data
+  const b = (await api('POST', `/api/workshop/channels/${channelId}/agents`, { name: 'iso-b', harness: 'omp', role: 'worker' })).data
+  const rows = (await api('GET', `/api/workshop/channels/${channelId}/agents`))?.data ?? []
+  const list = Array.isArray(rows) ? rows : (rows.agents ?? [])
+  const agentA = list.find(x => x.id === a?.id) ?? a
+  const agentB = list.find(x => x.id === b?.id) ?? b
+  ok('D1', '两个成员创建且有 token', Boolean(agentA?.token && agentB?.token), `${agentA?.id?.slice(0, 8)}/${agentB?.id?.slice(0, 8)}`)
+  await api('POST', '/api/workshop/agent-tools/bindings', { agentId: agentA.id, nodeId: aNode, kind: 'daq', mode: 'auto' })
+  await api('POST', '/api/workshop/agent-tools/bindings', { agentId: agentB.id, nodeId: bNode, kind: 'daq', mode: 'auto' })
+  const la = await api('GET', `/api/workshop/agent-tools/list?agentId=${agentA.id}`)
+  const lb = await api('GET', `/api/workshop/agent-tools/list?agentId=${agentB.id}`)
+  const da = (la?.data?.tools ?? []).find(t => t.name === 'daq_query')?.description ?? ''
+  const db = (lb?.data?.tools ?? []).find(t => t.name === 'daq_query')?.description ?? ''
+  ok('D2', 'A 描述只含自己的节点', da.includes(aNode) && !da.includes(bNode), `own=${aNode} other=${bNode}`)
+  ok('D3', 'B 描述只含自己的节点', db.includes(bNode) && !db.includes(aNode), `own=${bNode} other=${aNode}`)
+
+  const ra = await invoke(agentA, 'daq_query', { last_minutes: 1, limit: 5 })
+  const rb = await invoke(agentB, 'daq_query', { last_minutes: 1, limit: 5 })
+  const countA = Number((ra.text.match(/数采数据查询结果\((\d+) 个节点/) ?? [])[1])
+  const countB = Number((rb.text.match(/数采数据查询结果\((\d+) 个节点/) ?? [])[1])
+  ok('D4', 'A 查询只覆盖 1 个绑定节点', !ra.isError && countA === 1, ra.text.slice(0, 260))
+  ok('D5', 'B 查询只覆盖 1 个绑定节点', !rb.isError && countB === 1, rb.text.slice(0, 260))
+  const cross = await invoke(agentA, 'daq_query', { node_id: bNode, last_minutes: 1, limit: 5 })
+  ok('D6', 'A 调 B 的节点被拒', cross.isError && /未绑定|不在|可读|越权|拒绝|不可/.test(cross.text), cross.text.slice(0, 260))
+
+  const ev = { at: new Date().toISOString(), channelId, lineBound: Boolean(ch?.data?.lineId), aNode, bNode, agentA: agentA.id, agentB: agentB.id, countA, countB, cross: cross.text.slice(0, 500), results }
+  writeFileSync(join(EVID, 'agent-daq-isolation.json'), JSON.stringify(ev, null, 2))
+  return finish(ev)
+}
+function finish(ev) {
+  const pass = results.filter(r => r.pass).length
+  writeFileSync(join(EVID, 'agent-daq-isolation-summary.json'), JSON.stringify({ at: new Date().toISOString(), pass, fail: results.length - pass, results, ev }, null, 2))
+  console.log(`\n═══ Agent DAQ 隔离: ${pass}/${results.length} PASS ═══`)
+  if (pass !== results.length) process.exitCode = 1
+}
+main().catch((e) => {
+  console.error(e)
+  ok('D-ERR', '脚本未抛异常', false, e.message)
+  finish({})
+})

package/scripts/api-contract-smoke.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * API 契约 + Channel 作用域冒烟（2026-10-19）
+ *
+ * 补齐 api-live-e2e 未覆盖的只读面与真实的跨频道 agent-token 负例：
+ *  - health / users/me / channels / workspaces / daq / dcw / hitl / plugins / ops-logs 形状
+ *  - 两个临时频道：用 A 频道 lead 的实例 token 访问 B 频道的任务详情/列表，必须 403/SCOPE_VIOLATION
+ *  - 结束后删除两个临时频道，不触碰既有业务数据
+ *
+ * 运行：AW_BASE=http://127.0.0.1:3001 AW_TOKEN=<user-token> node scripts/api-contract-smoke.mjs
+ */
+const BASE = process.env.AW_BASE ?? 'http://127.0.0.1:3001'
+const TOKEN = process.env.AW_TOKEN
+if (!TOKEN) throw new Error('AW_TOKEN required (user token, admin or owner)')
+process.env.NO_PROXY = '127.0.0.1,localhost'
+
+const results = []
+const ok = (id, name, cond, detail = '') => {
+  results.push({ id, name, pass: Boolean(cond), detail: String(detail).slice(0, 400) })
+  console.log(`${cond ? '✔' : '✖'} [${id}] ${name}${cond ? '' : ` — ${String(detail).slice(0, 400)}`}`)
+}
+const api = async (method, path, { token = TOKEN, body } = {}) => {
+  const r = await fetch(BASE + path, {
+    method,
+    headers: { 'authorization': `Bearer ${token}`, 'content-type': 'application/json' },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal: AbortSignal.timeout(30_000),
+  })
+  const text = await r.text()
+  let json
+  try {
+    json = text ? JSON.parse(text) : {}
+  }
+  catch {
+    json = { raw: text }
+  }
+  return { status: r.status, ...json }
+}
+const data = r => r?.data ?? null
+const tag = `scope${Date.now().toString(36).slice(-5)}`
+const created = []
+
+async function createChannel(name) {
+  const r = await api('POST', '/api/workshop/channels', {
+    body: { name, description: 'api-contract-smoke', leadAgent: { name: `${name}-lead`, harness: 'mock', config: { delayMs: 80 } } },
+  })
+  if (r.code !== 0 || !data(r)?.channelId) throw new Error(`channel create failed: ${JSON.stringify(r).slice(0, 300)}`)
+  created.push(data(r).channelId)
+  return data(r)
+}
+
+try {
+  // ── 只读面 ──────────────────────────────────────────────────────────────
+  const health = await api('GET', '/api/health')
+  ok('R1', 'GET /api/health', health.code === 0 && health.data?.status === 'ok', `status=${health.status}`)
+
+  const me = await api('GET', '/api/users/me')
+  ok('R2', 'GET /api/users/me', me.code === 0 && Boolean(data(me)?.id) && Boolean(data(me)?.role), `role=${data(me)?.role}`)
+
+  const noAuth = await api('GET', '/api/users/me', { token: 'deadbeef' })
+  ok('R3', '无效 token /users/me → 401', noAuth.status === 401, `status=${noAuth.status}`)
+
+  const channels = await api('GET', '/api/workshop/channels')
+  ok('R4', 'GET /channels 数组', channels.code === 0 && Array.isArray(data(channels)), `n=${data(channels)?.length}`)
+
+  const workspaces = await api('GET', '/api/workshop/workspaces')
+  ok('R5', 'GET /workspaces 数组', workspaces.code === 0 && Array.isArray(data(workspaces)), `n=${data(workspaces)?.length}`)
+
+  const daq = await api('GET', '/api/workshop/daq')
+  ok('R6', 'GET /daq 节点面', daq.code === 0 && Array.isArray(data(daq)?.nodes), `nodes=${data(daq)?.nodes?.length}`)
+
+  const dcw = await api('GET', '/api/workshop/dcw')
+  ok('R7', 'GET /dcw 产线面', dcw.code === 0 && Array.isArray(data(dcw)?.lines) && Array.isArray(data(dcw)?.nodes), `lines=${data(dcw)?.lines?.length} nodes=${data(dcw)?.nodes?.length}`)
+
+  const hitl = await api('GET', '/api/workshop/hitl/pending')
+  ok('R8', 'GET /hitl/pending 形状', hitl.code === 0 && (Array.isArray(data(hitl)?.items) || Array.isArray(data(hitl))), `type=${Array.isArray(data(hitl)) ? 'array' : 'object'}`)
+
+  const plugins = await api('GET', '/api/workshop/plugins')
+  const pluginList = plugins.plugins ?? data(plugins)?.plugins
+  ok('R9', 'GET /plugins 列表', Array.isArray(pluginList), `n=${pluginList?.length}`)
+
+  const logs = await api('GET', '/api/workshop/ops-logs?limit=5')
+  ok('R10', 'GET /ops-logs 查询', logs.code === 0 && Array.isArray(data(logs)?.logs), `n=${data(logs)?.logs?.length} count=${data(logs)?.count}`)
+
+  // ── Channel 作用域 ─────────────────────────────────────────────────────
+  const a = await createChannel(`api-scope-A-${tag}`)
+  const b = await createChannel(`api-scope-B-${tag}`)
+  const bActivate = await api('POST', `/api/workshop/channels/${b.channelId}/activate`)
+  ok('C1', '创建两个临时频道并激活 B', Boolean(a.channelId && b.channelId && bActivate.code === 0), `A=${a.channelId?.slice(0, 8)} B=${b.channelId?.slice(0, 8)}`)
+
+  const bTask = await api('POST', `/api/workshop/channels/${b.channelId}/tasks`, {
+    body: { title: `scope-task-${tag}`, description: '跨频道作用域负例', mode: 'goal', modeConfig: { goalCriteria: '完成' } },
+  })
+  ok('C2', 'B 频道任务创建', bTask.code === 0 && Boolean(data(bTask)?.id), `task=${data(bTask)?.id?.slice(0, 8)}`)
+
+  const aAgents = await api('GET', `/api/workshop/channels/${a.channelId}/agents`)
+  const aLeadToken = data(aAgents)?.find?.(x => x.id === a.leadAgentId)?.token
+  ok('C3', 'A 频道 lead 实例 token 可读', Boolean(aLeadToken), `token=${aLeadToken ? 'yes' : 'no'}`)
+
+  const crossDetail = await api('GET', `/api/workshop/tasks/${data(bTask)?.id}`, { token: aLeadToken })
+  const deniedDetail = crossDetail.status === 403 || crossDetail.code === 'SCOPE_VIOLATION' || crossDetail.code === 'FORBIDDEN'
+  ok('C4', 'A token 读 B 任务详情 → 403/SCOPE_VIOLATION', deniedDetail, `status=${crossDetail.status} code=${crossDetail.code}`)
+
+  const mgmtList = await api('GET', `/api/workshop/channels/${b.channelId}/tasks`, { token: aLeadToken })
+  const mgmtDenied = [401, 403].includes(mgmtList.status) || mgmtList.code === 'SCOPE_VIOLATION' || mgmtList.code === 'FORBIDDEN'
+  const mgmtLeak = Array.isArray(data(mgmtList)) && data(mgmtList).some(x => x.id === data(bTask)?.id)
+  ok('C5', 'A token 访问 B 频道管理任务面被拒且无泄露', mgmtDenied && !mgmtLeak, `status=${mgmtList.status} code=${mgmtList.code} leaked=${mgmtLeak}`)
+
+  // agent token 真正使用的列表端点:必须 200 且只返回本频道任务
+  const scopedList = await api('GET', '/api/workshop/tasks', { token: aLeadToken })
+  const scopedRows = Array.isArray(data(scopedList)) ? data(scopedList) : (data(scopedList)?.tasks ?? [])
+  const scopedLeak = scopedRows.some(x => x.id === data(bTask)?.id)
+  ok('C6', 'A token 的 /tasks 列表 200 且不含 B 任务', scopedList.code === 0 && Array.isArray(scopedRows) && !scopedLeak, `status=${scopedList.status} code=${scopedList.code} n=${scopedRows.length} leaked=${scopedLeak}`)
+}
+catch (e) {
+  ok('FATAL', '脚本未抛异常', false, e.message)
+}
+finally {
+  for (const id of created) {
+    const r = await api('DELETE', `/api/workshop/channels/${id}`).catch(() => null)
+    console.log(`  cleanup channel ${id.slice(0, 8)} → ${r?.code ?? 'err'}`)
+  }
+  const failed = results.filter(x => !x.pass).length
+  console.log(`\n${failed === 0 ? '★ ALL PASS' : `✗ ${failed} FAILED`} (${results.length - failed} passed)`)
+  process.exit(failed === 0 ? 0 : 1)
+}